Tag Info

Hot answers tagged

40

There is no "patch". It's a vulnerability in the protocol, not a bug in the implementation. In Windows Server 2003 to 2012 R2 the SSL / TLS protocols are controlled by flags in the registry set at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols. To disable SSLv3, which the POODLE vulnerability is concerned with, ...


26

A person with administrative (or often even physical) access to a server is going to be able to extract the private key. Whether through exporting, memory sniffing, or other such trickery. Your administrators have access to the private keys of your web servers. Accept this as fact, and work around that. If your sysadmins aren't trustworthy, then you may ...


17

If you're not using IIS, you absolutely should remove it, for the reasons you mentioned - maintenance and security. The only effect of removing IIS is an inability to use IIS. No management or operational side effects - it hasn't been entrenched into the operating system like Internet Explorer has. Of the over 250 Windows servers I manage, less than 10 ...


16

Just for ease of installation I derived this "disable ssl 2 and 3.reg" file from Evan's answer above: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server] "Enabled"=dword:00000000 ...


12

The only overhead incurred will be the few bytes taken up in applicationHost.config to define the Application Pools and any non-default settings they may have. If you have a 1000 unused app pools it might improve the time it takes to apply on-the-fly configuration changes to IIS (since there's less XML for the WAS service to parse), but with 5 App Pools I ...


12

No. Microsoft offers an FTP over SSL (FTPS) solution but does not currently provide a solution for securing FTP traffic using FTP over SSH (SFTP)


11

When you import the key, you have the option of marking it as non-exportable. This will prevent you from using IIS or the certificate MMC to export it. At least, it makes it a little harder. However, if they have an administrator account on the machine, or have physical access to it - they will still be able to get the key through other means.


10

The Microsoft IIS server, nor Windows itself, do not support SFTP (or SSH) at all. On any version of IIS or Windows. The IIS supports secure FTP (FTPS or FTP over TLS/SSL) though. It's different (incompatible) protocol than SFTP. But most "FTP" clients support both SFTP and FTPS. When setting up FTPS server, make sure you disable plain (unencrypted) FTP! ...


9

Powershell to disable SSL2 and SSL3: 2..3 | %{ New-Item -Path "HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL $_.0\Server" -Name Enabled -Value 0 -Force }


9

IIS is not required on any Windows system, unless you want to host web sites; the only exception is if you are using any server role which runs on web services (such as WSUS) or offers them (such as Certificate Services). However, if you actually have any dependency on IIS, Windows itself will warn you about this when you try to remove the role; if this is ...


8

To address the most basic part of your question: Yes, you can send commands to a Windows Server from a web interface using the PowerShell Web Access feature in Windows Server 2012 and 2012 R2. For what you want (linking a user control in a web page to the execution of a specific action on the server), you might want to look into executing PowerShell from ...


6

This is a bug in Chrome. You can see in the code that Chrome maintains a list of registry controlled domains and that it needs updated as each gTLD is added. You can see in the effective_tld_names.dat file that the .care domain is not listed, though its listed for other browsers that use a more recent version of the Public Suffix List. This is what causes ...


6

The trick would be to run the Apache and IIS on different ports (only one service can bind to one port at a time), though there's far from any guarantee that WSUS or ePO would work properly on non-standard ports. McAfee's support was correct in recommending not running the two things on the same server, though both pieces of software do have options for ...


5

32bit Operating system with 16Gb ram will effectively leave 12Gb's unused. The upgrade to 64bit OS should defenitly be considered. Use of the PAE switch (Physical Adress Extension) could offer a temporary fix. For info with regards to max memory which a OS can use along with the PAE switch info look at: ...


5

Using Server Name Indication requires IIS 8.0. It was not supported in prior versions of IIS. To resolve the problem, do one of the following: Update to IIS 8.0 (and Server 2012). Use a web server other than IIS. Use unique IP addresses for each SSL-enabled web site.


5

Heartbleed allows memory to be exposed from the server on which [a vulnerable version of] OpenSSL is running, during a TLS connection. So, for heartbleed to be exploitable, a server must both be running a vulnerable version of OpenSSL AND accept TLS connections. Therefore, in Scenario 1, you'd be at risk of having the memory of your load balancer being ...


4


4

Oddness in GUI elements generally has to do with resource exhaustion issues. What that many running processes I wouldn't be surprised if you've had some kind of resource leak. I'd get Performance Monitor running and capture data to feed to the Performance Analysis of Logs (PAL) tool. This tool does a great job of identifying leaks. Getting started with PAL ...


4

In general, it's not a good idea to mix user data with application code. You should maintain these separately, as code lives better in a repo, while data lives in a DB or a "raw" storage system - very different ways of storing information. When you say "a ton" of documents, what does that mean? If you're looking at 100s of GBs in thousands of files, then a ...


4

Open your IIS manager and select the directory you want to protect. Under the "IIS" section select "Authentication". Disable "Anonymous Auth". Enable the desired Auth method (usually "Basic Auth") and it will be valid for this directory only. Add a User account. Give that user Read, Execute, List Permissions on the directory needed, then login via the newly ...


4

Here's a PowerShell that will test for the presence of the registry keys, create them if needed, and then enter the necessary values to disable SSL 2.0 and SSL 3.0 $regPath1 = 'HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\SSL 2.0' $regPath2 = 'HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\SSL ...


4

IIS provides a certificate chain to the client using the certificates loaded in the server computer's registry. You need to obtain the missing intermediate certificate and install it onto the server so that it can provide a complete certificate chain to clients.


3

The key difference between the New Relic .NET Agent and traditional profiling tools is that the New Relic .NET Agent doesn't instrument everything. Developers at New Relic have gone through and picked out key methods in various frameworks (e.g., ASP.NET) and libraries (e.g., SQL Server) and the agent injects code into those methods only. A traditional ...


3

Make sure that your catch-all binding is not of type IP:Port. When an IP:Port binding exists for an HTTPS binding while SNI is not required, that binding will always take precedence. For your catch-all case, use a *:Port binding (* being the all unassigned).


3

Also check this answer from here: Cannot manually edit applicationhost.config The answer is simple, if not that obvious: win2008 is 64bit, notepad++ is 32bit. When you navigate to Windows\System32\inetsrv\config using explorer you are using a 64bit program to find the file. When you open the file using using notepad++ you are trying to open it using a 32bit ...


3

In practice, simply apache2ctl graceful will gracefully restart apache process allowing it to load a new configuration Here for example, lets say you have in production www.v1 and dev in www.v2 <VirtualHost *:80> ServerName www.example.com DocumentRoot /var/www/vhosts/example.com/www.v1 [...] </VirtualHost> <VirtualHost ...


3

It looks like IIS8 doesn't support frontpage extensions. There's a third party vendor that supplies them; I haven't tried it myself. But apparently, As of December 18, 2010, Microsoft FrontPage Server Extensions (FPSE) 2002 for Windows Vista and Windows Server 2008 RTM is supported by Ready-to-Run Software, Inc. For support and servicing, contact ...


3

The Not enough storage available error has nothing to do with disk storage. It is about internal memory. This error is quite easy to reproduce. Simply select a bunch of large files (images or DLL's or whatever), right-click and use the open-with option to open them all with Notepad. This should eat up allot of internal memory. When the swap-file nears it's ...


3

Sorry to say, I think the only appropriate answer is "It depends" - and once you start digging into what "it depends" on, you'll find that you have to benchmark your current site, with good metrics. Then build each scenario you want to test, with a synthetic load that is as close to a busy day on your production site, and monitor the same metrics. Both from ...


3

Sorry to answer my own question, but I think this is worth putting out there for others info: When using Response.Redirect, outbound rules come into play. Viewing the requests with Fiddler helped work out what was going on with the links. Response.Redirect() was trying to send to /About.aspx (Transport in Response Headers). This was not being picked up by ...



Only top voted, non community-wiki answers of a minimum length are eligible